Data protection laws in the United States
United States privacy law is a complex patchwork of national, state and local privacy laws and regulations. There is no comprehensive national privacy law in the United States. However, the US does have a number of largely sector-specific privacy and data security laws at the federal level, as well as many more at the state (and local) level. In recent years, beginning with California in 2018, states have begun to introduce and enact their own comprehensive privacy laws. Although bipartisan draft bills (e.g., the American Privacy Rights Act of 2024) have been introduced since then , changes in the political climate, industry influence, and the increasing complexity of privacy concerns have stifled efforts of passing an omnibus law. Thus, a comprehensive privacy law on the federal level is not expected to pass any time soon.
Federal and State Privacy Laws and Regulations
Federal laws and regulations include those that apply to financial institutions, telecommunications companies, credit reporting agencies and healthcare providers, as well as driving records, childrenâs online privacy, telemarketing, email marketing, biometrics, and communications privacy laws.
There are also a number of state privacy and data security laws that can overlap with federal law(s)âsome of these state privacy laws are preempted in part by federal laws, while others are not. Some US states have also privacy and data security laws and regulations that apply across sectors and go beyond requirements imposed by federal lawsâsuch as data security laws, secure destruction, Social Security number privacy, online privacy, biometric information privacy, and data breach notification laws. Generally, these state laws apply to personal information about residents of or activities that occur within each of these states, respectively. Thus, many businesses operating in the United States must comply not only with applicable federal law, but also with numerous state privacy and security laws and regulations.
For example, California alone has more than 25 state privacy and data security laws, including the comprehensive CCPA, which provides definitions and broad individual rights and imposes requirements and restrictions on the collection, use, disclosure, and processing of personal information of CA residents. The CCPA is unique among the existing state comprehensive privacy laws in that, it applies not only to personal information related to consumers but also in the HR and B2B context. Enforcement of the updated CCPA regulations, which were finalized March 29, 2023, commenced on March 29, 2024, by the newly established California Privacy Protection Agency, referred to as the âCPPAâ or âAgency.â On November 8, 2024, the Agency Board voted to commence supplementary CCPA rulemaking on certain additional regulatory subjects: CCPA Updates, Cybersecurity Audits, Risk Assessments, Automated Decisionmaking Technology (ADMT), and Insurance Companies. Specifically, the proposed regulations seek to (1) update existing CCPA regulations; (2) implement requirements for certain businesses to conduct privacy risk assessments and complete annual cybersecurity audits; (3) implement the right to access and opt-out of being subject to ADMT; and (4) clarify when insurance companies must comply with the CCPA. The public comment period for these proposed regulations closes on February 19, 2025.
The CPPA also enforces the "Delete Act," effective January 1, 2024, which imposes deletion obligations on data brokers, thereby allowing consumers to more easily delete their personal information held by data brokers in California. Under the Delete Act, the CPPA must establish an accessible deletion mechanism by January 1, 2026. This mechanism is intended to allow consumers to make a single verifiable deletion request to have their data deleted by data brokers and their associated service providers or contractors.
In August 2022, the California legislature passed the California Age-Appropriate Design Code (CAADC), which was slated to take effect July 1, 2024, and would apply to companies that meet the definition of âbusinessâ under the CCPA and that provide online services that are likely to be accessed by individuals under 18 years of age. However, on September 18, 2023, a California District Court issued an injunction blocking the law from coming into effect on First Amendment grounds. Following an appeal to the Ninth Circuit by the California Attorney General's office, the fate of the law is currently uncertain. More information on the California Age-Appropriate Design Code is available online.
Similarly, Maryland has enacted the âKids Codeâ and Connecticut amended its Consumer Data Protection Act to include similar protections for childrenâs personal information. Moreover, in January 2025, the Federal Trade Commission (FTC) finalized significant changes to the federal Childrenâs Online Privacy Protection Act (COPPA). While the FTC periodically reviews the COPPA rule, these rule changes are the first amendment to COPPA since 2013. According to the FTC, the final amended rule reflects technological advancements since COPPA was last amended and is intended to enhance online safety for children. More information on the amended rule is available online. The combined efforts of federal and state regulators are intended to pave the way for a safer digital landscape and ensure that children's privacy is prioritized in an increasingly connected world.
Beyond Californiaâs CCPA, additional comprehensive state privacy laws have also taken effect, including the
- Colorado Privacy Act,
- Connecticut Data Privacy Act (including amendments regulating consumer health data, childrenâs data, and social media platforms),
- Delaware Personal Data Privacy Act,
- Florida Data Privacy and Security Act,
- Iowa Consumer Data Protection Act,
- Montana Consumer Data Privacy Act,
- Nebraska Data Privacy Act,
- New Hampshire Consumer Expectation of Privacy Act,
- New Jersey Personal Data Privacy Act,
- Oregon Consumer Privacy Act,
- Texas Data Privacy and Security Act,
- Utah Consumer Privacy Act, and
- Virginia Consumer Data Protection Act.
While not identical, the these comprehensive state privacy laws are, with the exception of the CCPA, substantially similar to each other in most respects, but may differ in certain regards, for example, scope, privacy notice disclosures, privacy rights, and certain key definitions. These state laws are also generally inapplicable to personal information collected about, and processed in the context of, employee and business relationships. While the CCPA has some practical similarities with these state laws, it adopts more granular definitions, requirements, and restrictions that vary considerably from these laws, and, notably, also applies to personal information collected from California residents in employment and B2B contexts.
There have also been significant developments in the health data space, beginning in 2023 with Washington passing the landmark My Health My Data Act (MHMD). The law ostensibly applies only to consumer health data, but its exceptionally broad definitions and scope combined with its private right of action may mean its enforcement touches on data many companies may not typically consider âhealthâ data. More information on the MHMD Act is available online. Since MHMD, other states have followed suitâNevada passed the Nevada Consumer Health Data Privacy Law through senate bill 370, effective March 31, 2024, and Connecticut amended the Consumer Data Privacy Act to include similar provisions for protecting consumer health data, effective October 1, 2023.
Finally, the pace of state privacy legislation has continued to accelerate overall, with the following states also passing their own comprehensive privacy laws or variations thereof, and even more states introducing similar legislation:
- Tennessee (effective July 1, 2025)
- Minnesota (effective July 21, 2025)
- Maryland (effective November 1, 2025)
- Indiana (effective January 1, 2026)
- Kentucky (effective January 1, 2026)
- Rhode Island (effective January 1, 2026)
Enforcement of Unfair and Deceptive Trade Practices
In the United States, consumer protection laws, which prohibit unfair and deceptive business practices, provide another avenue for enforcement against businesses for their privacy and security practices.
At the federal level, the US Federal Trade Commission (FTC) uses its authority to protect consumers against unfair or deceptive trade practices, to take enforcement actions against businesses for materially unfair privacy and data security practices. The FTC uses this authority to, among other things, take enforcement actions and investigate companies for:
- Failing to implement reasonable data security measures
- Making materially inaccurate or misleading privacy and security statements, including in privacy policies
- Failing to abide by applicable industry self-regulatory principles
- Transferring or attempting to transfer personal information to an acquiring entity in a bankruptcy or M&A transaction, in a manner not expressly disclosed on the applicable consumer privacy policy
- Violating consumer privacy rights by collecting, using, sharing or failing to adequately protect consumer information, in violation of standards established in their prior enforcement precedents
Many state attorneys general have similar enforcement authority over unfair and deceptive business practices, including failure to implement reasonable security measures and violations of consumer privacy rights that harm consumers in their states. State attorneys general also sometimes work together on enforcement actions against companies for actions that broadly affect the consumers of multiple states (such as data breaches).
Key Areas of Privacy Class Action
Privacy class actions continue to be a significant risk area in the United States, including in the context of biometric privacy (under the Illinois Biometric Privacy Act), text messaging (under the federal Telephone Consumer Privacy Act) and call recording, wiretapping and related claims under the California Invasion of Privacy Act, the Video Privacy Protection Act (VPPA) and other state laws. Online monitoring and targeting activitiesâincluding via cookies, pixels, chat bots, and so-called âsession replayâ toolsâare an area of particular focus in the eyes of both regulators and plaintiffâs attorneys. Under the CCPA, data breaches due to inadequate security measures, allow for a private right of action. The highlight the evolving landscape of privacy litigation, emphasizing the need for businesses to comply with stringent data protection regulations to avoid legal repercussions.
